Don't allow matching on functions without justification

Otherwise we have patterns which type check, and which are considered
total, but which can't be properly check at run-time.

Fixes #138